{"id":"CVE-2012-4681","kind":"vulnerability","aliases":["CVE-2012-4681"],"related":[],"title":"Oracle Java SE: Oracle Java SE Runtime Environment (JRE) Arbitrary Code Execution Vulnerability","description":"Multiple vulnerabilities in the Java Runtime Environment (JRE) component in Oracle Java SE 7 Update 6 and earlier allow remote attackers to execute arbitrary code via a crafted applet that bypasses SecurityManager restrictions by (1) using com.sun.beans.finder.ClassFinder.findClass and leveraging an exception with the forName method to access restricted classes from arbitrary packages such as sun.awt.SunToolkit, then (2) using \"reflection with a trusted immediate caller\" to leverage the getField method to access and modify private fields, as exploited in the wild in August 2012 using Gondzz.class and Gondvv.class.","summary":"Beans-component flaw in the Java 7 browser plug-in (JDK/JRE 7 Update 6 and before). A malicious web page running an untrusted applet or Web Start app escapes the sandbox and runs code (CVSS 2.0 10.0). Exploited in the wild since Aug 2012, Metasploit module public, in CISA KEV since 2022-03-03. Oracle says it does not apply to servers, standalone desktop apps or Java SE Embedded. The same alert also fixes CVE-2012-1682 and CVE-2012-3136.","severity":"critical","cvss":10.0,"epss":0.98536,"exploited":true,"exploited_at":"2022-03-03T00:00:00+00:00","products":[{"name":"Oracle Java SE","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"Oracle Java SE (JDK/JRE)","fixed":[],"affected":"7 Update 6 and before","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["applet","browser","desktop","exploited","java","jre","oracle-java-se","ransomware","runtime","windows"],"not_affected_if":["java-6","java-se-embedded","no-browser-plugin","no-java-installed","server-only","standalone-app"],"how_to_check":"Run 'java -version' on desktops. Java 7 at 1.7.0_06 or earlier is affected. Check whether the Java browser plug-in or applets / Web Start are enabled (Java Control Panel > Security). Java 6 is not listed as affected for this CVE; Oracle's risk matrix lists only Java 7.","fix":"Move Java 7 to a current supported release (Oracle's alert fix is cumulative; the exact Update number is not stated on the page, so unknown from sources). Disable the Java browser plug-in and remove old JREs that are not needed.","status":"open","published_at":"2012-08-28T00:55:01+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:26:11+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"runtime","confidence":0.85,"triage":{"at":"2026-10-23T21:26:11Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Oracle Java SE update per vendor instructions, as CISA requires; the fixed version is unknown from the sources.\nRemove or disable old Java runtimes that are not needed.","reach":"internet","impact":"high","summary":"The Java Runtime Environment in Oracle Java SE has a flaw that lets remote code execute. An attacker who gets a user to run a crafted Java applet or program can run code on the machine.","category":"runtime","who_cares":["java","oracle-java-se","jre","windows","desktop"],"confidence":0.6,"needs_auth":"no","worst_case":"Remote attacker runs arbitrary code on the Java host.","analyst_note":"Confirm affected and fixed Java SE versions and whether a browser or applet trigger is required, via the CISA KEV entry and the Oracle CPU advisory for 2012.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["no-java-installed"],"user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.00047,"input_tokens":2832,"output_tokens":373,"severity_before":"unknown"},"analyst_status":"done","analyst_note":"Confirm affected and fixed Java SE versions and whether a browser or applet trigger is required, via the CISA KEV entry and the Oracle CPU advisory for 2012.","search":"'-03':94B,95B '-1682':118B '-2012':15A,18A,117B,121B '-3136':122B '-4681':16A,19A '1':157C '10.0':78B '2':179C '2.0':77B '2012':85B,205C '2022':93B '6':55B,138C '7':47B,53B,136C 'access':169C,193C 'alert':113B 'allow':141C 'also':114B 'app':69B,106B 'applet':27B,65B,151C 'appli':101B 'arbitrari':10A,146C,173C 'attack':143C 'aug':84B 'august':204C 'bean':41B 'beans-compon':40B 'browser':28B,48B 'bypass':153C 'caller':186C 'cisa':90B 'class':171C 'code':11A,75B,147C 'com.sun.beans.finder.classfinder.findclass':159C 'compon':42B,131C 'craft':150C 'cve':14A,17A,116B,120B 'cvss':76B 'desktop':29B,105B 'earlier':140C 'embed':110B 'environ':8A,129C 'escap':70B 'except':163C 'execut':12A,145C 'exploit':30B,79B,199C 'field':197C 'fix':115B 'flaw':43B 'fornam':166C 'getfield':190C 'gondvv.class':209C 'gondzz.class':207C 'immedi':185C 'java':2A,5A,21A,24A,31B,35B,46B,108B,127C,134C 'jdk/jre':26A,52B 'jre':9A,32B,130C 'kev':91B 'leverag':161C,188C 'malici':59B 'metasploit':86B 'method':167C,191C 'modifi':195C 'modul':87B 'multipl':123C 'oracl':1A,4A,34B,96B,133C 'oracle':20A,23A 'oracle-java-s':33B 'packag':174C 'page':61B 'plug':50B 'plug-in':49B 'privat':196C 'public':88B 'ransomwar':37B 'reflect':181C 'remot':142C 'restrict':155C,170C 'run':62B,74B 'runtim':7A,38B,128C 'sandbox':72B 'say':97B 'se':3A,6A,22A,25A,36B,109B,135C 'securitymanag':154C 'server':103B 'sinc':83B,92B 'standalon':104B 'start':68B 'sun.awt.suntoolkit':177C 'trust':184C 'untrust':64B 'updat':54B,137C 'use':158C,180C,206C 'via':148C 'vulner':13A,124C 'web':60B,67B 'wild':82B,202C 'window':39B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2012-08-28T00:55:01+00:00","kev":{"dateAdded":"2022-03-03","dueDate":"2022-03-24","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2012-4681","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2012-4681","severity":null,"published_at":"2022-03-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T16:39:49+00:00","note":null},{"source":"epss","external_id":"CVE-2012-4681","url":"https://api.first.org/data/v1/epss?cve=CVE-2012-4681","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"analyst","external_id":"CVE-2012-4681:79","url":null,"severity":null,"published_at":"2026-10-23T21:26:51+00:00","modified_at":"2026-10-23T21:26:51+00:00","first_seen_at":"2026-10-23T21:26:51+00:00","fetched_at":"2026-10-23T21:26:51+00:00","note":"Read Oracle's Security Alert (30 Aug 2012) and NVD/KEV entry. Browser/applet only; exact fixed Update number is not on the Oracle page (says apply latest, cumulative), so left unknown."},{"source":"nvd","external_id":"CVE-2012-4681","url":"https://nvd.nist.gov/vuln/detail/CVE-2012-4681","severity":null,"published_at":"2012-08-28T00:55:01+00:00","modified_at":"2026-08-06T05:16:34+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[{"id":1019,"url":"https://www.oracle.com/security-alerts/alert-cve-2012-4681.html","title":"Oracle Security Alert for CVE-2012-4681","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1020,"url":"https://nvd.nist.gov/vuln/detail/CVE-2012-4681","title":"NVD CVE-2012-4681 (KEV entry, references)","kind":"other","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}